Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DOGE worker’s code supports NLRB whistleblower

krebsonsecurity.com

Post reply on HN
Print view View original

451–460 of 586 posts

Re: DOGE worker’s code supports NLRB whistleblower

#451

Post by BrenBarn »

nativeit wrote: post #221
BrenBarn wrote: post #165

Earlier quoted context omitted.

> I think it's been used properly in a lot of instances, especially when you consider that federal law can quickly become out-of-step with modern sensibilities, so being able to relieve those harmed by laws flawed under contemporary standards is important. No, that is exactly what we don't need. When law becomes out of step with modern sensibilities, the law needs to be changed. Precisely the problem we currently hav…

That's not really what I meant. Just because a law is repealed or changed, doesn't mean the people who were sentenced to prison because of its original form will receive revised sentences.

You can revise their sentences with law as well.

Re: DOGE worker’s code supports NLRB whistleblower

#452

Post by jabiko »

Palmik wrote: post #402
mythrowaway49 wrote: post #263

this part of the whistleblower complaint seem way worse: " On or about March 11, 2025, NxGen metrics indicated abnormal usage at points the prior week. I saw way above baseline response times, and resource utilization showed increased network output above anywhere it had been historically – as far back as I could look. I noted that this lined up closely with the data out event. I also notice increased logins blocked…

I wonder why the "no-out-of-country logins" block happens after verifying login credentials and not before, which would make more sense to me.

Since the system is hosted on Azure, I guess we are talking about an Entra ID login. So I think they set up a Conditional Access [1] that can blocks logins based on the country IP. These policies run after authentication and can be specific to a user.

[1] https://learn.microsoft.com/en-us/entra/identity/conditional...

Re: DOGE worker’s code supports NLRB whistleblower

#453

Post by brigandish »

From the "critique"[0]:

> Upon learning of your resignation, following reports that you were linked to an account advocating to “normalize Indian hatred” and for a “eugenic immigration policy,” I can’t help but address the staggering hypocrisy of these views within the context of the IT industry.

> This field, including your own career, is built on the labor, innovation, and expertise of Indian engineers and developers. To hold such hateful beliefs about a group that forms the backbone of this industry isn’t just reprehensible—it’s a complete contradiction of the reality you benefit from every day.

> My original critique of your code addressed technical issues and provided solutions, but after learning about your expressed views, it’s clear that poor coding isn’t the root problem here. Your mindset is incompatible with the fundamental values of IT: collaboration, respect, and global interconnectedness.

> Someone who advocates for hate cannot build systems meant to serve diverse users, nor can they lead or contribute meaningfully to teams that rely on trust and mutual respect. I strongly suggest you reflect on the harm your beliefs cause—not just to others, but to your credibility and future in this profession.

It doesn't invalidate the same author's critique above it at all (the critique itself manages to do that) but how it ended up mentioned in Krebs' article is puzzling. It harkens back to the days when journalists would quote-mine random Twitter users' tweets as if it meant something. "Twitter user @john89674651684685 said…" Give me a break.

[0] https://web.archive.org/web/20250423135719/https://github.co...

Re: DOGE worker’s code supports NLRB whistleblower

#454

Post by yibg »

rockemsockem wrote: post #262
polalavik wrote: post #50

Earlier quoted context omitted.

Just, as an exercise, list out 3 good reasons someone might want untraceable admin accounts then list 3 really bad reasons they might want that. If you manage to find 3 good reasons does the outcome of those those outweigh the risks of the potential bad reasons?

Good: 1. The account-level below that doesn't have access to certain stuff and just happened to have untraceable stuff 2. They just said "give me the highest level of access" and didn't investigate what that meant 3. Can't think of a good third atm Bad: 1. They want to do nefarious things untraceably 2, 3. I think 1. covers pretty much everything. Personally, if I'm put in charge of overhauling a system I don't want…

I honestly don't understand the defenses of these actions here. Forget about the nature of data we're talking about here. If I was an engineer working at say google, and I put in mechanisms to access a bunch of data and bypass both auth and audit, I'd get fired instantly.

Re: DOGE worker’s code supports NLRB whistleblower

#455

Post by DonHopkins »

ahwelatif wrote: post #446
dragonwriter wrote: post #433

Earlier quoted context omitted.

It's uses a simple, purpose-focused template of a type that is a common recommendation for clear communication, outline numbering, and highlights keywords using monospaced text, as is common practice in technical writing. None of that is unusual for a human, especially writing something that they know is going to be high visibility, to do. Modestly competent presentation is now getting portrayed as an "AI tell".

I'm relatively confident this critique is AI-powered. The dead giveaways: 1. Verbosity. Developers are busy people and security researcher devs are busy even moreso. Someone so skilled wouldn't spend more than 2-3 sentences of time in critiquing this repo. 2. Hostility. Writing bug free code is hard, even impossible for most. Unless your name is Linus Torvalds, Richard Hipp, or maybe Dan Abramov, most devs are not co…

I hope this trend of DOGE using the US Government to cyberbully people they don't like goes away.

Re: DOGE worker’s code supports NLRB whistleblower

#456

Post by BrenBarn »

lovich wrote: post #290
BrenBarn wrote: post #161

Earlier quoted context omitted.

> Laws are only as strong as the enforcement. This is one of the fundamental issues that underlies our broken system in the US. The gaps between what the law actually is, what people think it is, what people want it to be, and what it in practice is, are enormous. Some of the recent deportation cases highlight this. You have cases where people were living in the US illegally for decades but faced no repercussions, an…

Bruh, do you think people are pissed about the deportations just because they’re immigrants? Deport them all if they came here illegally and that was _proven_, but the government just skipped all due process and as we’re seeing and as the government already admitted, people are being mistakenly deported to these camps and then the same government says they can’t do anything to reverse it. You can’t be waxing poetic a…

Following due process is part of enforcement, and yeah, it needs to be done in accordance with law. But we've had problems with due process for a long time. One example is that our court system is not remotely adequate to handle the load it actually needs to handle. The result is long delays in justice (which usually benefit those with enough resources to wait it out), as well as a heavy reliance on plea bargains (which can act as an end-run around due process by applying pressure on vulnerable accused people to essentially waive their due process rights).

I don't disagree that there are huge problems with how enforcement is currently happening. My point is that we've had those problems for a long time and the current situation is just pushing things to the breaking point along the same axis.

Re: DOGE worker’s code supports NLRB whistleblower

#457

Post by somenameforme »

dragonwriter wrote: post #433
captainkrtek wrote: post #427

Earlier quoted context omitted.

Yea clearly AI with the keyword bolding, numbered arguments, and so on. Feel like lots of AI produced content follow this structured response pattern.

It's uses a simple, purpose-focused template of a type that is a common recommendation for clear communication, outline numbering, and highlights keywords using monospaced text, as is common practice in technical writing. None of that is unusual for a human, especially writing something that they know is going to be high visibility, to do. Modestly competent presentation is now getting portrayed as an "AI tell".

It has excellent presentation, excess verbosity, and is wholly nonsensical. Read the code. It uses excessive whitespace doing things like function calls/declarations with one parameter per line, and so it's probably like 100 lines "real" code of mostly tight functions -- the presentation/objections make no sense whatsoever.

I was able to generate extremely comparable output from ChatGPT by telling it to create a hyper-negative review, engage in endless hyperbole, and focus on danger, threats, and the obvious inexperience of the person who wrote it. Such is the nature of LLMs it'd happily produce the similar sort of nonsense for even the cleanest and tightest code ever written. I'll just quote its conclusion because LLM verbosity is... verbose.

---

Conclusion This code is a ticking time bomb of security vulnerabilities, AWS billing horrors, concurrency demons, and maintenance black holes. It would fail any professional code review:

Security: Fails OWASP Top 10, opens SSRF, IP spoofing, credential leakage

Reliability: Race conditions, silent failures, unbounded threading

Maintainability: Spaghetti architecture, no documentation, magic literals

Recommendation: Reject outright. Demolish and rewrite from scratch with proper layering, input validation, secure defaults, IAM roles, structured logging, and robust error handling.

---

Oooo sick burn. /eyeroll

Re: DOGE worker’s code supports NLRB whistleblower

#458

Post by BrenBarn »

Larrikin wrote: post #333
BrenBarn wrote: post #161

Earlier quoted context omitted.

> Laws are only as strong as the enforcement. This is one of the fundamental issues that underlies our broken system in the US. The gaps between what the law actually is, what people think it is, what people want it to be, and what it in practice is, are enormous. Some of the recent deportation cases highlight this. You have cases where people were living in the US illegally for decades but faced no repercussions, an…

Do you believe there should be criminal prosecution for state and local government officials currently refusing to to work with ICE in its current form in the Trump administration?

In a sense, yes. I lean more and more toward the idea that we're not going to get out of this mess without "hitting rock bottom", so to speak. That means we have to somehow confront people with the reality of the laws we actually have, not the imaginary ones we've convinced ourselves we have. If we had those kinds of criminal prosecutions we might get riots in the streets and revolutions that would result in changes to the laws. Moreover, if we had had those kinds of criminal prosecutions in the past (e.g., George Wallace), we might have been able to fix things with less pain than will be required now.

Re: DOGE worker’s code supports NLRB whistleblower

#459

Post by paulgb »

ahwelatif wrote: post #446
dragonwriter wrote: post #433

Earlier quoted context omitted.

It's uses a simple, purpose-focused template of a type that is a common recommendation for clear communication, outline numbering, and highlights keywords using monospaced text, as is common practice in technical writing. None of that is unusual for a human, especially writing something that they know is going to be high visibility, to do. Modestly competent presentation is now getting portrayed as an "AI tell".

I'm relatively confident this critique is AI-powered. The dead giveaways: 1. Verbosity. Developers are busy people and security researcher devs are busy even moreso. Someone so skilled wouldn't spend more than 2-3 sentences of time in critiquing this repo. 2. Hostility. Writing bug free code is hard, even impossible for most. Unless your name is Linus Torvalds, Richard Hipp, or maybe Dan Abramov, most devs are not co…

I agree on all counts. The readme of the repo you link also smacks of an AI generated summary of the codebase. (Frankly, I don’t think the AI was able to understand what the code in that repo does, which is my guess as to why it talked much about form rather than function.)

Re: DOGE worker’s code supports NLRB whistleblower

#460

Post by Corrado »

cmurf wrote: post #353
tootie wrote: post #329

Earlier quoted context omitted.

Interview with whistleblower detailing the attack and the threats directed against him: https://www.pbs.org/newshour/show/nlrb-whistleblower-claims-...

this guy's lawyer says: This is a difficult topic for Dan to discuss, but prior to our filing the whistle-blower disclosure this week, last week, somebody went to Dan's home and taped a threatening note, a menacing note on his door with personal information. ... While he was at work, and it also contained photographs of him walking his dog taken by a drone. This is mafia shit.

I just finished watching Daredevil: Born Again[0] and this incident looks shockingly familiar to what happened in the show. I don't know how the show runners knew this was going to happen but it feels like they've been spying on the future. Do they have a time machine or are they really that good (and the current administration that bad)?

[0] https://www.imdb.com/title/tt18923754/

Post reply on HN